The better fix would be to not have the username pass through a parser looking for cli flags in the first place.